Skip to content
VibeBeacon

For apps built with Cursor, Claude Code, Lovable, Bolt, v0 and Replit

Get an email when a version in your app has a known security hole

Run one command in your project. VibeBeacon reads your lockfile, checks those exact versions against public advisories from OSV, GitHub, NVD and CISA, and emails you when one matches. Each alert comes with a fix prompt you can paste into your coding agent.

Start freeSee the live demo, no signup

First app free. No card. We never see your code.

Extra apps are USD $2 a month each. We receive package names and versions, not files. What we store

bash
npx vibebeacon@latest login
npx vibebeacon@latest scan --upload

Needs Node 20 or later. No shell in your tool? Use the no-shell prompt.

From terminal to fixed

The whole loop runs from your terminal and your coding agent. You approve what changes.

  1. 1

    Link the CLI to your account

    Opens your browser so you can approve this machine. You do it once. No key to copy.

    bash
    npx vibebeacon@latest login

  2. 2

    Scan and upload

    Reads package.json, your lockfile and runtime files, writes vibebeacon.json, and uploads it. The upload asks for a match straight away.

    bash
    npx vibebeacon@latest scan --upload

  3. 3

    Paste the fix prompt into your agent

    Each app page and alert email has a prompt with the advisories, your versions and the target versions. Paste it into Claude Code, Cursor or Codex. Pick review only, or let it apply the compatible fixes. The CLI prints the same plan.

    bash
    npx vibebeacon@latest review

  4. 4

    The agent pushes the result back

    If you allow the upload, the agent re-scans after its fixes and sends the new inventory. Alerts that no longer match close, and the app page shows what changed.

    bash
    npx vibebeacon@latest scan --upload

Free and Pro apps are re-checked about every 30 minutes, Team about every 10. A version match does not prove the bug is reachable in your code, so the prompt asks your agent to check that. Fixing alerts

What the alert email looks like

From VibeBeacon <alerts@vibebeacon.app>

To you@example.com

critical advisory in My Coffee Shop POS: next

A security advisory affects My Coffee Shop POS

critical

Authorization Bypass in Next.js Middleware

next 15.1.0, fixed in 15.2.3

A request with a crafted header can skip checks that run in middleware, such as auth. The advisory says Vercel-hosted deployments are protected.

npm install next@15.2.3

GHSA-f82v-jwr5-mffw

Review with your AI tool

The email ends with a prompt for your coding agent. It lists the advisory, the version you run and the target, and asks the agent to check the claims before changing anything.

Open the dashboardAlert settingsUnsubscribe

Example email. The advisory is real (March 2025) and the app is made up. Later Next.js advisories need newer versions than 15.2.3, so check current fixes before you update. A version match does not prove your app is exploitable. Delivery time depends on source refresh, matching and email delivery.

What we store, and what we never see

We keep app inventory and account records to run the service. A leaked inventory could help an attacker target an app, so we keep the list short and protect what we hold. It never includes your code or your keys.

We store

  • Package names and reported versions, with direct, development and resolution flags
  • The ecosystem for each package, such as npm or PyPI
  • Runtime and framework versions, such as Node 22.11.0 and Next 15.1.0
  • Hosting provider names, such as Vercel or Fly
  • Service names, such as Stripe or Supabase
  • Your email address and app identity, optional groups and tags
  • Scan date, generator version, tool names and workspace counts

We never see

  • Your source code
  • Your .env files. The CLI will not open them
  • Application secrets, passwords or connection strings in scan payloads
  • File paths, repo URLs or database names
  • Your customers, your data or your traffic
  • Access to your GitHub, your host or your database

The privacy page shows the exact JSON we receive, field by field. How we protect you covers encryption, sign-in and infrastructure.

I'm a vibe coder like you, with several apps in production. I use Dependabot too, but I needed one page across everything I run, and an email only when a version I actually use has a hole. That is why I built VibeBeacon. Read why I built it.

Three ways to add an app

All three produce the same file, so use whichever your tool supports.

CLI

Run this in your project folder.

bash
npx vibebeacon@latest scan --upload
CLI reference
Prompt

Paste this into Cursor or Claude Code. The docs have a no-shell version for Lovable, Bolt and v0.

prompt
Scan this project and upload the inventory to VibeBeacon.

I authorise sending the documented scan JSON to https://vibebeacon.app/api/v1/manifests using the credential already configured for VibeBeacon. Payload: schema/generator version, scan date, app identity and optional group/tags, package names, versions, ecosystems, direct/dev/resolved flags, runtimes, frameworks, service/hosting/tool names and workspace counts. No source code, file paths, dependency trees, environment values or credentials in the payload. Do not print or inspect the credential. Do not use an alternative destination without my approval.

Run npx vibebeacon@latest scan --upload --api https://vibebeacon.app from the project root.
If no credential is configured, ask me to run npx vibebeacon@latest login. Never inspect or print it.
Do not read .env files, change dependencies or upload source code. Preserve app identity and scan scope.
Report inventory status, changed alert IDs and reasons, score changes and any pending processing.
Missing packages are not verified fixes. If the command fails, report its safe error and stop.
Both prompt variants
MCP

Add the server to your editor and ask it to scan the project. It can read back your open alerts too.

.mcp.json
{
  "mcpServers": {
    "vibebeacon": {
      "command": "npx",
      "args": ["-y", "vibebeacon-mcp"]
    }
  }
}
Config for Claude Code, Cursor, Windsurf and Claude Desktop

Pricing

Free

Free

One app. No card needed, no time limit

  • One app, watched the same way as a paid one
  • Instant email on high and critical advisories
  • Daily or weekly digest, your choice
  • App/group notification controls
  • Full alert history
  • API, MCP and GitHub Action access
Start free

Pro

Two or more apps

USD $2

per app per month, or USD $19.20 per app per year

Everything in Free, plus

  • As many apps as you want, each watched the same way
  • Your first app stays free, so five apps costs USD $8
  • Stack Insights, which is closed on the free plan
  • Add or archive an app any time; billable slots have a 30-day hold
  • Monthly or yearly, switched from the billing page

One subscription with a count on it. Cancel any time and your apps pause rather than delete.

Start free, add apps later

Team

USD $5

per app per month, or USD $48 per app per year

Everything in Pro, plus

  • Slack, Discord and webhook alerts
  • Checks every 10 minutes instead of every 30
  • Audit export and a monthly PDF report
  • Email the founder, usually within one business day

Every app is billed on Team. There is no free first app.

Start free, move to Team later

Full pricing has the plan comparison, the cost calculator and the billing rules.

Questions

What exactly do you store about my app?

Package names, versions, ecosystems, dependency flags, runtimes, frameworks, hosting, service and tool names, scan date, generator version, app identity, optional groups/tags and workspace counts. No code, no paths, no env values, no keys, no repo URLs. The CLI refuses to read .env files, and the server rejects any manifest that contains something secret-shaped.

Why not just use Dependabot or npm audit?

Keep using them. Dependabot works one GitHub repo at a time. npm audit checks the lockfile in the folder you are in, when you run it. VibeBeacon keeps your last upload for every app and re-checks it on a schedule, without repo access. It also flags runtime versions near end of life and shows security news from the services you list. The comparison page has more detail.

What if I cannot run a shell, like on Lovable, v0 or Bolt?

Use the no-shell prompt. It asks your AI tool to write the JSON from package.json and the lockfile. A version read from a range like ^15.1.0 is a guess, so we mark it unresolved and match it conservatively.

How much email will I get?

By default, only high and critical matches send an instant email. Everything else goes into a daily digest, and news is batched weekly. You can change this for each app or group. Dev-only dependencies do not send instant email by default.

Why should I trust you?

You do not have to. Run the CLI with --json and read the file before anything is sent. The source repository is private, but you can download the published npm package and read it. The privacy page shows the JSON we receive. Each app page lists what we hold, with a delete button. We never ask for access to your code, your host or your database.

Try it on one app

No match means no instant email. Lower-severity matches go into a daily digest you can switch to weekly.

Start freeOr look at the live demo first